Users of online services can register for online accounts, such as email accounts, social networking accounts, online banking accounts, health services accounts and/or the like. The most popular way to register for an account is to provide a username and password. These accounts often provide some type of recovery mechanism in case a user forgets his or her login information. For example, an account may send a recovery email that includes access information to a user's trusted email account if the user forgets his or her login information.
However, this recovery feature is often exploited by hijackers who are able to gain control of the user's email recovery account. A hijacker who gains control of a user's email recovery account can use the recovery feature of an online service to gain control of this account as well.